Cryptography December 2015

cryptography@lists.squeakfoundation.org

6 participants
18 discussions

[SecureSession] version 74 is out with compression enabled
by Robert Withers 23 Dec '15

23 Dec '15

Check it in the crypto repo. Next up? refactor over to new frames. On deck? ReedSolomon -- . .. ... ^,^ robert Go Panthers!

1 0

#cryptography channel
by Robert Withers 21 Dec '15

21 Dec '15

Note there is now a #cryptography channel at slack: https://pharoproject.slack.com. cheers, -- . .. ... ^,^ robert Go Panthers!

1 0

version 50 of SecureSession is released
by Robert Withers 18 Dec '15

18 Dec '15

SecureSession is now FEC encoded. thanks, -- . .. .. ^,^ robert

1 2

Re: [squeak-dev] potential to include cryptography in base image
by Robert Withers 18 Dec '15

18 Dec '15

On 12/15/2015 10:02 PM, David T. Lewis wrote: > On Tue, Dec 15, 2015 at 05:00:12AM -0500, Robert Withers wrote: >> It was suggested to me that I write to the list and raise the question >> about cryptography being included in the base image. Really I have 3 >> questions I would ask you all: >> >> 1. is it desirable to include cryptography? >> 2. is it feasible to include cryptography? >> 3. what is the time frame for including cryptography? > I'm not sure whether it is a good idea to include it in the base image, > versus maintain it in an external package that can be easily loaded > from SqueakMap. Either way, I think we should get it updated on > SqueakMap first so that more people can (and hopefully will) load > it in their images, run the tests, and get experience with it. FWIW, > I personally tend to favor maintaining packages externally in cases > where we have an interest in supporting the package on various > kinds of images, such as Squeak/Cuis/Pharo. > > Robert, are you in a position to update the SqueakMap entries? Currently > they are "crypto", "Cryptography", and "Cryptography Team Package". They > are all out of date, and I'm not sure who owns which version. We should > pick one of them as the official one, and update it so that it loads the > latest version (Cryptography-rww.49) into a Squeak 4.6 or 5.0 image. > > It is of course quite easy to load Cryptography directly from squeaksource, > but there are quite a few packages in that repository that may seem confusing > for someone loading Cryptography for the first time, so I think a one-click > download from SqueakMap would be helpful. Thank you for your view of these matters. I must apologize for being forgetful about SqueakMap. I have no idea if I can login or not, it has been years. I have requested a new passwd so shortly I will be in. Do we want these artifacts on SqueakSource and SqueakMap? There are a lot of other packages in Cryptography on SqueakSource. I have cleaned up some of the packages I have in Mushroom. Some, like Blowfish, may want to be folded into the core package. Plugins will want to stay. I suppose better documentation would help, some for Pharo and some for Squeak. I got frustrated in the course of this as I think others did, as well. My apologies for simplifying a complex area and being to simplistic, at times. Regards, Robert > Dave > > -- . .. .. ^,^ robert

2 1

pluginizing Galois Fields
by Robert Withers 18 Dec '15

18 Dec '15

I thought I would post to these lists. I have a nascent implementation of Reed-Solomon encoding using Galois Fields. Computation within the field is governed by polynomial representation and operations (add, subtract, multiply, divide, inverse, exp, log). These operations on polynomials is where the profile says most time is being used. The code can be seen in the SecureSession package in squeaksource's Cryptography repository. The point of this email is to see if the folks who would know how to represent polynomials and operations in Slang would be interested in working towards this performance effort, whether through discussion of implementation. How would you Slanginize a polynomial and it's operations? manythanks, -- . .. .. ^,^ robert

1 0

New version (47) of SecureSession for Pharo & Squeak
by Robert Withers 18 Dec '15

18 Dec '15

Please load the SecureSession.47 and drive it about a bit. I am missing crypto plugins on Pharo, so avoid the performance test, tto stay responsive. Here are some of the changes: - frame-based pipeline - header per msg so no mutable session state - header is written with message in Asn1Der encoding. - most header fields currently optional - adding per-connection msgId to header - timeSent set also - reworked TransportEndpoint to be better scoped. Looking forward: - extend frames into the strategy utilities - events Any issues or questions, please reach out. Thanks, robert

1 0

interleaving indexing has me scrambled
by Robert Withers 17 Dec '15

17 Dec '15

In particular the tempIndex of the second scan goes out of range and I scratching my head. If anyone actually wants to look at how this method works and can help, awesome! :) best, robert --- interleave: symbols blockCount: blockCount | symbolsPerChunk table interleaved interleavedBlock fourChunk symbolsPerBlock | ((symbols size \\ 4) > 0) ifTrue: [self error: 'interleaving bytes size not a multiple of 4']. symbolsPerChunk := symbols size // blockCount. symbolsPerBlock := symbols size // (blockCount // 4). table := OrderedCollection new: 4 withAll: 0. table at: 1 put: (ByteArray new: symbolsPerChunk withAll: 0). table at: 2 put: (ByteArray new: symbolsPerChunk withAll: 0). table at: 3 put: (ByteArray new: symbolsPerChunk withAll: 0). table at: 4 put: (ByteArray new: symbolsPerChunk withAll: 0). interleavedBlock := ByteArray new: (symbols size / blockCount) withAll: 0. interleaved := ByteArray new: (symbols size + 1) withAll: 0. interleaved at: 1 put: blockCount. 0 to: blockCount - 1 do: [ :blockIndex | | end start | start := blockIndex * symbolsPerBlock + 1. end := (blockIndex + 1) * symbolsPerBlock. fourChunk := symbols copyFrom: start to: end. "first scan: bytes to populate the table" 0 to: 3 do: [ :chunkIndex | | chunk slice symbol | chunk := fourChunk copyFrom: (chunkIndex * symbolsPerChunk + 1) to: ((chunkIndex + 1) * symbolsPerChunk). 1 to: symbolsPerChunk do: [ :index | slice := table at: (chunkIndex + 1). symbol := chunk at: index. slice at: index put: symbol]]. "second scan: table to populate the interleaved bytes" 1 to: symbolsPerChunk do: [ :index | 0 to: 3 do: [ :chunkIndex | | localIndex offset tempIndex symbol | offset := symbolsPerBlock * blockIndex. tempIndex := index * 4 + chunkIndex - 3. localIndex := offset + tempIndex. symbol := (table at: (chunkIndex + 1)) at: index. interleavedBlock at: localIndex put: symbol]]. start := symbols size / blockCount * blockIndex + 1. end := symbols size / blockCount * blockIndex + interleavedBlock size. interleaved replaceFrom: (start + 1) to: (end + 1) with: interleavedBlock startingAt: 1]. ^ interleaved

1 3

review, validation and test development for GenericGF
by Robert Withers 15 Dec '15

15 Dec '15

Hi all, sticking with the distribution for discussing Crypto in the base, I am currently trying to stabilize a port of Reed-Solomon such that FEC can be added to SecureSession. I am doing this work in SecureSession. I just posted an update of the GenericGF class, with the Java implementation attached here. I need this critical code reviewed and tested. You need Cryptography and SecureSession to be included in the catalog. If you can help me with the former, I could help with the latter, if that suits you. Please let me know! Please load Cryptography(-Pharo) and SecureSession.23 for review. "ported & refactored GenericGF from the java code. This includes reindexing from 0 to 1. Having no tests, hopefully someone can give a review of this specific class. Where some tests to be developed at this scope, that would be stellar." I appreciate. -- . .. .. ^,^ best, robert

1 1

Re: potential to include cryptography in base image
by Robert Withers 15 Dec '15

15 Dec '15

Thank you, Sven, giving me the opportunity to scope the right mailing lists into the discussion. I love that Pharo is oriented towards business. My particular excitement is to see all the scientific computing. These recent threads on expanding capacity and targeting marketing are good. I think Cryptography in the base, including SecureSession, adds to that effort. The Cryptography package, both for squeak and the Cryptography-Pharo package, and in the Cryptography repository (http://www.squeaksource.com/Cryptography. Through the Monticello Browser this is a loadable item. The loading of SecureSession, which is loadable by both squeak and pharo, ois a separate load. I appreciate that pharo has established a different mechanism for loading. At this time, I am deep into fixing ReedSolomon FEC code, so I must be conservative (which I am) and defer learning and including Cryptography in that mechanism. I must be careful what promises I make and I cannot make a commitment here. If you are interested in seeing this in pharo's catalog, then the Cryptography team welcomes new members, especially from new environments. Welcome. We appreciate all the work that you do! Again, I appreciate the opportunity to engage the community in discussion around the definition and example of a minimal modular image that includes Cryptography & SecureSession in the base. NB: I think that business computing and scientific computing does not equal mobile devices, necessarily. I have long made the case, with varying degrees of effectiveness, that squeak belongs on the server. A SecureSession & Cryptography capability in the base, minimal, headless image is desired: the first question in the OP. Therefore, the correct target of growth is not mobile, it is BigData! On 12/15/2015 05:20 AM, Sven Van Caekenberghe wrote: > Robert, > > I think that the Pharo community, part of which is more business oriented, is absolutely interested in more and better Crypto code. In any case, I am. > > What we absolutely want, if it is not already the case (I did not check), is that the Crypto code can be loaded using 1 single action (through our validated Monticello configurations and Catalog mechanism) - I am sure you will find help to achieve and maintain (through a CI process) that goal. > > Whether it should be a base part of the image is another question. Modularity is a huge goal for Pharo. This is a much harder discussion (as the same can be said of or asked for for many packages that are generally useful: XML, CSV, JSON, SQL, ...). In any the case, the first step is the one described in the previous paragraph. Then you need traction, usage, and maybe demand for full inclusion. > > Regards, > > Sven > >> On 15 Dec 2015, at 11:00, Robert Withers <robert.w.withers(a)gmail.com> wrote: >> >> It was suggested to me that I write to the list and raise the question about cryptography being included in the base image. Really I have 3 questions I would ask you all: >> >> • is it desirable to include cryptography? >> • is it feasible to include cryptography? >> • what is the time frame for including cryptography? >> Given the thread on password hashing (and salting and so on), there are good, solid implementations in the cryptography package. Looking in the Cryptography repository, there is a Pharo 5.0 compatible Cryptography package. >> >> In light of another recent thread discussing random number generation, discussion about the best approach to random algorithms in cryptography ought be engaged. For instance, the SecureRandom algorithm evidently provides some level of guarantee. >> >> To underline the solidity I am attaching a profile of all 102 cryptography tests passing green. This profile demonstrates that there are no areas of particular inefficiency - nothing stands out to be improved - means that the entire library is maximally efficient. >> >> And so I please ask that we have these discussions, for there is a lot of value in this package for general and basic use. >> >> >> -- >> . .. ... ^,^ best, robert >> <Cryptography Spy Results.text.gz> -- . .. .. ^,^ best, robert

1 0

requesting some guidance
by Robert Withers 12 Dec '15

12 Dec '15

It's been suggesting to combine crypto plugins into one plugin. I'm researching and a few questions arose: 1) are plugins supposed to be thread-safe? Some plugins have state modified by its primitives (DESPlugin, DSAPlugin) 2) some are subclassing InterpretedPlugin and some are subclassing SmartSyntaxInterpreterPlugin. Which should the combined CryptoPlugin subclass, preferably? Either way, there is rewriting needed. 3) should we have 2 plugins (SmartCryptoPlugin and CryptoPlugin) initially, then rewrite? I appreciate, Robert

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography December 2015